Security and responsible disclosure

Our approach

This is a small, simple website that holds very little data. That is deliberate, because data we do not keep cannot be stolen. We add protection where it matters and keep the rest plain.

How the site is protected

• Connections are encrypted, and browsers are told to use HTTPS only
• A strict content security policy lets only our own code and a short list of named services run on the pages
• The public pages are static. There is no visitor database, no account system and no login on the public site
• The contact and application forms use a spam check from Cloudflare, a hidden trap field and a minimum time check, and uploaded CVs are limited by type and size
• There are no advertising trackers
• The page where we edit the site is separate. Only named people can sign in, through GitHub, and every change is recorded and can be reversed
• The site is served through Cloudflare, which filters floods of traffic and known malicious requests before they reach it

Reporting a vulnerability

If you find a weakness, please write to the collaboration address on the Contacts page. Tell us the page, what you did and what you saw, and keep the details to yourself until we have fixed it. We machine-publish this contact in our security.txt file as well.

We ask you to test only with your own data, not to access or change anyone else's information, not to run tests that slow the site down and not to use social engineering. We will acknowledge your report within five working days and keep you informed. We will not take legal action against research carried out in good faith within these limits.

Fraudulent messages

We never ask for passwords, card details or urgent payments by email, message or through this website. Our fees follow a signed agreement. If a message in our name asks for money or a change of bank details, check it with us by phone on the number shown on the Contacts page before you act.

Security file

Our contact for security reports is also published in the standard location, /.well-known/security.txt, so researchers and automated tools can find it.